Right to Information Wiki - courses:dpdp

Course dashboard — DPDP Act 2023 + Rules 2026 Crash Course

anonymous@undisclosed.example.com (Anonymous) — Fri, 24 Apr 2026 20:07:45 +0000

2026/04/25 07:36	current
Line 1:	Line 1:
	+	{{htmlmetatags>metatag-keywords=(dpdp course dashboard, dpdp app, dpdp progress)&metatag-description=(Course dashboard for DPDP Act 2023 + Rules 2026 Crash Course. Track progress, take quizzes, take final, get certificate.)}}
	+
	+	====== Course dashboard — DPDP Act 2023 + Rules 2026 Crash Course ======
	+
	+
	+	<WRAP center round tip 95%>
	+	🎯 Take the quiz / final exam now:
	+
	+	* [[https://righttoinformation.wiki/courses-quiz-app.html?course=dpdp\|→ Open the interactive course dashboard (quiz + final exam)]] — login required.
	+	</WRAP>
	+
	+	<WRAP center round important 95%>
	+	📍 Interactive dashboard rolling out shortly. All 4 modules + final exam content is live now. The dashboard with progress tracking + quiz interface is being adapted from the existing CPD course backend. For now, read modules, bookmark progress; quiz interface follows in the next 48-72 hours.
	+	</WRAP>
	+
	+	===== Modules =====
	+
	+	* [[:courses:dpdp:module-01\|Module 01 — DPDP Act 2023 — what changed]]
	+	* [[:courses:dpdp:module-02\|Module 02 — Data principal rights + Fiduciary obligations]]
	+	* [[:courses:dpdp:module-03\|Module 03 — DPDP Rules 2026 — operational details]]
	+	* [[:courses:dpdp:module-04\|Module 04 — DPDP × RTI interplay — for both PIOs and citizens]]
	+	* [[:courses:dpdp:final\|Final exam]]
	+
	+	===== Related =====
	+
	+	* [[:courses:dpdp:start\|← Course overview]]
	+	* [[:courses:\|All courses]]
	+
	+	{{tag>course dpdp dashboard}}

Final exam — DPDP Act 2023 + Rules 2026 Crash Course

anonymous@undisclosed.example.com (Anonymous) — Fri, 24 Apr 2026 20:07:45 +0000

2026/04/25 07:36	current
Line 1:	Line 1:
	+	{{htmlmetatags>metatag-keywords=(dpdp final exam, dpdp certificate, dpdp rti exam)&metatag-description=(Final exam for DPDP Act 2023 + Rules 2026 Crash Course. 18 questions, 12 minutes, 70% to pass.)}}
	+
	+	====== Final exam — DPDP Act 2023 + Rules 2026 Crash Course ======
	+
	+	<WRAP center round info 95%>
	+	18 questions · 12-minute timer · 3 attempts · 70% to pass · Honor Code required. Certificate (serial DPDP-XXXXXXXXXX) issued instantly on pass.
	+	</WRAP>
	+
	+	===== Eligibility =====
	+
	+	Pass all 4 module quizzes (70%+) before opening the final.
	+
	+	===== Open the exam =====
	+
	+	* [[:courses:dpdp:app\|→ Course dashboard]]
	+
	+	//Last reviewed: 24 April 2026.//
	+
	+	{{tag>course dpdp final-exam}}

Module 01 — DPDP Act 2023 — what changed

anonymous@undisclosed.example.com (Anonymous) — Fri, 24 Apr 2026 20:07:45 +0000

2026/04/25 07:36	current
Line 1:	Line 1:
	+	{{htmlmetatags>metatag-keywords=(dpdp module 01, dpdp act 2023 — what changed)&metatag-description=(DPDP Act 2023 + Rules 2026 Crash Course — Module 01: DPDP Act 2023 — what changed. Understand the Acts scope and structure in 60 minutes.)}}
	+
	+	====== Module 01 — DPDP Act 2023 — what changed ======
	+
	+	{{ :social:auto:dpdp-module-01.png?direct&1200 \|DPDP Act 2023 + Rules 2026 Crash Course Module 01}}
	+
	+	<WRAP center round info 95%>
	+	Goal: Understand the Act's scope and structure in 60 minutes.
	+	</WRAP>
	+
	+	===== A timeline + why it matters =====
	+
	+	- 2017: Justice Srikrishna Committee report
	+	- 2019: PDP Bill introduced
	+	- 2022: Withdrawn
	+	- August 2023: DPDP Act passed
	+	- February 2026: DPDP Rules notified
	+
	+	For RTI work: §8(1)(j) of RTI Act is recalibrated by DPDP. The two laws now interact at every personal-data RTI.
	+
	+	===== Scope of DPDP =====
	+
	+	Applies to digital personal data processed:
	+	- In India
	+	- Outside India in the course of offering goods/services to data principals in India
	+
	+	Exclusions:
	+	- Personal/domestic use
	+	- Publicly available data (with caveats)
	+	- Court-ordered processing
	+	- Research/statistical/archival (with safeguards)
	+
	+	===== Key terms =====
	+
	+	- Data Principal = the person whose data
	+	- Data Fiduciary = the entity that decides purposes/means (≈ Controller in GDPR)
	+	- Data Processor = entity processing on behalf of Fiduciary
	+	- Consent Manager = registered intermediary for managing consent
	+	- Significant Data Fiduciary (SDF) = high-volume / sensitive — extra obligations
	+	- Data Protection Board of India (DPB) = adjudicatory body
	+
	+	===== §6: Consent =====
	+
	+	Consent must be:
	+	- Free (not coerced)
	+	- Specific (per purpose)
	+	- Informed (privacy notice in clear language, in 22 schedule languages)
	+	- Unconditional (services cannot be denied for refusing optional consent)
	+	- Unambiguous (positive action, not pre-ticked)
	+	- Withdrawable (any time, as easy as giving)
	+
	+	Consent for children (<18): verifiable parental consent required.
	+
	+	===== §7: Legitimate uses (no consent needed) =====
	+
	+	7 legitimate uses where consent is bypassed:
	+	- (a) Voluntary provision by data principal
	+	- (b) State function — subsidy, benefit, license
	+	- (c) Compliance with judgement
	+	- (d) Medical emergency
	+	- (e) Disaster / public-health crisis
	+	- (f) Employment-related (limited)
	+	- (g) Public interest specified in Rules
	+
	+	This is the bridge to RTI — RTI requests for govt records often map to §7(b)/(g).
	+
	+	===== ✅ Quiz =====
	+
	+	Quiz available from your [[:courses:dpdp:app\|course dashboard]].
	+
	+	===== Next =====
	+
	+	* [[:courses:dpdp:start\|← Course overview]]
	+	* Next: [[:courses:dpdp:final]]
	+
	+	//Last reviewed: 24 April 2026.//
	+
	+	{{tag>course dpdp module-01}}

Module 02 — Data principal rights + Fiduciary obligations

anonymous@undisclosed.example.com (Anonymous) — Fri, 24 Apr 2026 20:07:45 +0000

2026/04/25 07:36	current
Line 1:	Line 1:
	+	{{htmlmetatags>metatag-keywords=(dpdp module 02, data principal rights + fiduciary obligations)&metatag-description=(DPDP Act 2023 + Rules 2026 Crash Course — Module 02: Data principal rights + Fiduciary obligations. Map every right + obligation to a practical action.)}}
	+
	+	====== Module 02 — Data principal rights + Fiduciary obligations ======
	+
	+	{{ :social:auto:dpdp-module-02.png?direct&1200 \|DPDP Act 2023 + Rules 2026 Crash Course Module 02}}
	+
	+	<WRAP center round info 95%>
	+	Goal: Map every right + obligation to a practical action.
	+	</WRAP>
	+
	+	===== Rights of data principals (§11-§14) =====
	+
	+	- §11 — Right to information about processing (similar to GDPR Art. 15)
	+	- §12 — Right to correction + erasure (similar to Art. 16-17, but with limits)
	+	- §13 — Right to grievance redressal — file with Fiduciary first; escalate to DPB
	+	- §14 — Right to nominate — appoint another individual to exercise rights upon death/incapacity
	+
	+	Notably absent: data portability, right to object to processing (compared to GDPR).
	+
	+	===== Obligations of fiduciaries (§8) =====
	+
	+	Every Fiduciary must:
	+	- Process for lawful purpose only
	+	- Implement reasonable security safeguards
	+	- Notify the DPB + affected data principals of breaches
	+	- Erase data when purpose is fulfilled (and inform Processors)
	+	- Publish business contact for grievance officer
	+
	+	===== Significant Data Fiduciary additional obligations =====
	+
	+	SDFs (notified by Government):
	+	- Appoint Data Protection Officer (DPO) based in India
	+	- Conduct Data Protection Impact Assessment (DPIA) for high-risk processing
	+	- Conduct periodic audits by independent Data Auditors
	+
	+	Likely SDFs: large e-commerce, healthcare aggregators, banking, telco.
	+
	+	===== Children's data (§9) =====
	+
	+	- Verifiable parental consent required for processing children's data (<18)
	+	- Cannot do tracking, behavioural monitoring, targeted advertising at children
	+	- Cannot cause harm to children
	+	- DPB can exempt platforms that demonstrate verifiable safe processing
	+
	+	===== Cross-border transfer (§16) =====
	+
	+	Default: data can flow to any country EXCEPT those notified as restricted by Central Government.
	+
	+	This is more permissive than GDPR's adequacy decisions. The restricted list (when notified) becomes the bottleneck.
	+
	+	===== ✅ Quiz =====
	+
	+	Quiz available from your [[:courses:dpdp:app\|course dashboard]].
	+
	+	===== Next =====
	+
	+	* [[:courses:dpdp:start\|← Course overview]]
	+	* Next: [[:courses:dpdp:final]]
	+
	+	//Last reviewed: 24 April 2026.//
	+
	+	{{tag>course dpdp module-02}}

Module 03 — DPDP Rules 2026 — operational details

anonymous@undisclosed.example.com (Anonymous) — Fri, 24 Apr 2026 20:07:45 +0000

2026/04/25 07:36	current
Line 1:	Line 1:
	+	{{htmlmetatags>metatag-keywords=(dpdp module 03, dpdp rules 2026 — operational details)&metatag-description=(DPDP Act 2023 + Rules 2026 Crash Course — Module 03: DPDP Rules 2026 — operational details. Master the practical implementation rules.)}}
	+
	+	====== Module 03 — DPDP Rules 2026 — operational details ======
	+
	+	{{ :social:auto:dpdp-module-03.png?direct&1200 \|DPDP Act 2023 + Rules 2026 Crash Course Module 03}}
	+
	+	<WRAP center round info 95%>
	+	Goal: Master the practical implementation rules.
	+	</WRAP>
	+
	+	===== Notice format (Rule 3) =====
	+
	+	Privacy notice must:
	+	- Be in English + at least one schedule language preferred by data principal
	+	- State purpose in clear, plain language
	+	- List categories of personal data processed
	+	- State rights + how to exercise
	+	- Include link to Fiduciary's contact + grievance officer
	+	- Include withdrawal mechanism
	+
	+	Format: maximum 1 page; readable on a phone.
	+
	+	===== Consent records (Rule 4) =====
	+
	+	Each consent must be logged with:
	+	- Identity of data principal
	+	- Date + time + IP / device fingerprint
	+	- Purpose for which consent given
	+	- Verbatim notice text version-stamped
	+
	+	Retention: until consent is withdrawn + 2 years for compliance audit.
	+
	+	===== Breach notification (Rule 7) =====
	+
	+	Personal data breach → notify within 72 hours:
	+	- To DPB: incident details, scope, mitigation
	+	- To affected data principals: nature of breach, expected harm, mitigation steps
	+	- Even if low-risk, log internally
	+
	+	Failure to notify = penalty up to ₹250 crore (per §33 Schedule).
	+
	+	===== Children's consent (Rule 10) =====
	+
	+	Verifiable parental consent methods:
	+	- Aadhaar-linked OTP to parent
	+	- DigiLocker-issued parent ID
	+	- Video-call verification + signed consent form
	+
	+	No single method mandated; Fiduciary picks 'reasonable' method.
	+
	+	===== Cross-border restricted list (Rule 12) =====
	+
	+	Central Government can notify restricted countries. Until notified — all destinations open.
	+
	+	For a Fiduciary: monitor MeitY notifications; tag data flows by destination country in your data inventory; have a contingency plan for re-routing if a destination is restricted.
	+
	+	===== ✅ Quiz =====
	+
	+	Quiz available from your [[:courses:dpdp:app\|course dashboard]].
	+
	+	===== Next =====
	+
	+	* [[:courses:dpdp:start\|← Course overview]]
	+	* Next: [[:courses:dpdp:final]]
	+
	+	//Last reviewed: 24 April 2026.//
	+
	+	{{tag>course dpdp module-03}}

Module 04 — DPDP × RTI interplay — for both PIOs and citizens

anonymous@undisclosed.example.com (Anonymous) — Fri, 24 Apr 2026 20:07:45 +0000

2026/04/25 07:36	current
Line 1:	Line 1:
	+	{{htmlmetatags>metatag-keywords=(dpdp module 04, dpdp × rti interplay — for both pios and citizens)&metatag-description=(DPDP Act 2023 + Rules 2026 Crash Course — Module 04: DPDP × RTI interplay — for both PIOs and citizens. Apply the right standard at the §8(1)(j) boundary.)}}
	+
	+	====== Module 04 — DPDP × RTI interplay — for both PIOs and citizens ======
	+
	+	{{ :social:auto:dpdp-module-04.png?direct&1200 \|DPDP Act 2023 + Rules 2026 Crash Course Module 04}}
	+
	+	<WRAP center round info 95%>
	+	Goal: Apply the right standard at the §8(1)(j) boundary.
	+	</WRAP>
	+
	+	===== §8(1)(j) of RTI vs DPDP =====
	+
	+	§8(1)(j) RTI exempts personal information unless disclosure is in larger public interest OR the information would have been disclosed to Parliament/Legislature.
	+
	+	DPDP doesn't override RTI but adds a consent factor:
	+	- Living individual + sensitive personal data → DPDP Rule 4: PIO should consider data principal consent
	+	- Deceased/historical data → DPDP largely doesn't apply; pure §8(1)(j) test
	+	- Public-servant 'public activity' → §8(1)(j) doesn't shield (per Karnataka HC 9-Feb-2026)
	+
	+	===== PIO workflow under combined regime =====
	+
	+	For each personal-information RTI:
	+	- Is the data subject a public servant in their public-activity capacity? → §8(1)(j) doesn't apply; disclose.
	+	- Is the data subject deceased? → DPDP doesn't apply; pure §8(1)(j) test.
	+	- Is the data subject a private individual? → §11 third-party notice (RTI) + consider DPDP consent factor.
	+	- Is the request large-public-interest? → §8(2) override applies; disclose with redaction.
	+
	+	===== §7(b) state function + DPDP =====
	+
	+	DPDP §7(b) allows the State to process personal data for benefit/subsidy/license without consent. This means:
	+	- Govt can collect Aadhaar-linked subsidy data without separate consent under DPDP
	+	- But the data can still be requested under RTI as 'records held by public authority'
	+	- Combination: data was lawfully processed under DPDP + can be requested under RTI subject to §8 / §10
	+
	+	===== Citizen actions =====
	+
	+	For citizens whose personal data is held by govt:
	+	- DPDP §11 right to information: ask the Fiduciary what data is held + how processed
	+	- RTI §6(1): ask the public authority for records about you
	+	- These overlap — but DPDP gives you the right to correction + erasure; RTI doesn't.
	+	- For breach by govt: file with DPB under §34
	+
	+	===== Penalties + Data Protection Board =====
	+
	+	Data Protection Board of India (DPB) — 4-7 members appointed by Central Govt, 2-year terms.
	+
	+	Penalties (Schedule):
	+	- Failure to take security safeguards: up to ₹250 crore
	+	- Failure to notify breach: up to ₹200 crore
	+	- Failure to fulfill child-data obligations: up to ₹200 crore
	+	- Other obligations: up to ₹50 crore
	+
	+	DPB appeals → Telecom Disputes Settlement and Appellate Tribunal (TDSAT) → Supreme Court.
	+
	+	===== ✅ Quiz =====
	+
	+	Quiz available from your [[:courses:dpdp:app\|course dashboard]].
	+
	+	===== Next =====
	+
	+	* [[:courses:dpdp:start\|← Course overview]]
	+	* Next: [[:courses:dpdp:final]]
	+
	+	//Last reviewed: 24 April 2026.//
	+
	+	{{tag>course dpdp module-04}}

🔐 DPDP Act 2023 + Rules 2026 Crash Course

anonymous@undisclosed.example.com (Anonymous) — Fri, 24 Apr 2026 20:07:45 +0000

2026/04/25 07:36	current
Line 1:	Line 1:
	+	{{htmlmetatags>metatag-keywords=(dpdp course, dpdp rti, free dpdp course, certified dpdp)&metatag-description=(DPDP Act 2023 + Rules 2026 Crash Course. 4 modules · 4 hours · §6 consent, §7 legitimate uses, §8(1)(j) interplay. Free, online, with verifiable certificate.)}}
	+
	+	====== 🔐 DPDP Act 2023 + Rules 2026 Crash Course ======
	+
	+	===== Audience =====
	+
	+	Both citizens and PIOs — complementary law to RTI
	+
	+	===== Modules =====
	+
	+	- [[:courses:dpdp:module-01\|Module 01 — DPDP Act 2023 — what changed]]
	+	- [[:courses:dpdp:module-02\|Module 02 — Data principal rights + Fiduciary obligations]]
	+	- [[:courses:dpdp:module-03\|Module 03 — DPDP Rules 2026 — operational details]]
	+	- [[:courses:dpdp:module-04\|Module 04 — DPDP × RTI interplay — for both PIOs and citizens]]
	+	- [[:courses:dpdp:final\|Final exam]] (18 Q · 12 min · 70% to pass)
	+
	+	===== Final exam =====
	+
	+	* 18 questions
	+	* 12-minute timer
	+	* 3 attempts
	+	* 70% to pass
	+	* Tab-locked + Honor Code
	+
	+	===== Certificate =====
	+
	+	Print-ready PDF + serial DPDP-XXXXXXXXXX + public verification URL + LinkedIn-ready badge. Valid 12 months; refresher quiz to renew.
	+
	+	===== Related =====
	+
	+	* [[:courses:\|All certified courses]]
	+	* [[:cpd:start\|Advanced PIO/FAA CPD course]]
	+	* [[:state-rti-portals-directory\|State portals]]
	+
	+	//Last reviewed: 24 April 2026.//
	+
	+	{{tag>course dpdp free certified}}